Heap Out-of-Bounds Read Vulnerability in BACnet Stack by BACnet

CVE-2026-58265

What is CVE-2026-58265?

The BACnet Stack, an open source protocol library for embedded systems, contains a vulnerability that allows a BACnet/SC peer to trigger a heap out-of-bounds read of up to three bytes prior to authentication. The issue arises from the function bvlc_sc_decode_proprietary_option() which reads fixed offsets for the vendor ID and option type without first validating the declared header length. Furthermore, the option-list validator does not enforce a minimum length for proprietary options, leaving systems at risk. This vulnerability affects versions prior to 1.4.5, 1.5.1, and 1.6.0, which have since been patched to mitigate the risk.

References